CVE-2025-32705: Microsoft 365 Apps RCE Vulnerability

CVE-2025-32705 Overview

CVE-2025-32705 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Outlook. The flaw allows an unauthorized attacker to execute code locally on a vulnerable system. Exploitation requires user interaction, typically by opening a specially crafted file or message in Outlook. Microsoft published the advisory on May 13, 2025, and the issue affects multiple Microsoft Office distributions including Microsoft 365 Apps and Office Long Term Servicing Channel 2021 and 2024.

Successful exploitation can compromise confidentiality, integrity, and availability on the targeted host. The vulnerability does not require attacker privileges but does require the victim to interact with malicious content.

Critical Impact

An attacker can achieve local code execution in the context of the Outlook user by inducing the victim to open a crafted message or file.

Affected Products

• Microsoft 365 Apps (Enterprise)
• Microsoft Office Long Term Servicing Channel 2021
• Microsoft Office Long Term Servicing Channel 2024

Discovery Timeline

• 2025-05-13 - CVE-2025-32705 published to NVD
• 2025-05-13 - Microsoft releases security update for CVE-2025-32705
• 2025-05-19 - Last updated in NVD database

Technical Details for CVE-2025-32705

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in Microsoft Office Outlook. Out-of-bounds reads occur when code reads memory outside the bounds of an allocated buffer. In parser code that processes structured message or attachment data, this class of flaw can be combined with controlled buffer contents to corrupt program state and redirect execution flow.

The Common Vulnerability Scoring System (CVSS) vector indicates local attack vector with required user interaction. The EPSS exploit prediction score is 0.739%, placing this CVE in the 73rd percentile for likelihood of exploitation activity. No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Root Cause

The root cause is improper validation of input bounds while Outlook parses attacker-controlled content. Reading past the intended buffer boundary exposes adjacent memory and, depending on how the result is used, allows attackers to influence execution.

Attack Vector

An attacker delivers a crafted file or message to the victim. The victim must open the content in Outlook for exploitation to occur. Once triggered, the attacker executes code in the context of the current user. Standard email-based delivery (phishing, malicious attachment) is the most plausible delivery method given the affected application.

No public exploit code is available for CVE-2025-32705. Refer to the Microsoft Security Update Guide for vendor-supplied technical details.

Detection Methods for CVE-2025-32705

Indicators of Compromise

• Outlook process (OUTLOOK.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, rundll32.exe, or wscript.exe.
• Unusual file writes by Outlook to user-writable directories including %TEMP%, %APPDATA%, or %LOCALAPPDATA%.
• Outbound network connections initiated immediately after opening an email or attachment.
• Crash dumps or Windows Error Reporting events referencing Outlook modules following message preview or open.

Detection Strategies

• Hunt for parent-child relationships where OUTLOOK.EXE launches scripting interpreters or LOLBins.
• Alert on suspicious DLL loads or in-memory modules within the Outlook process after attachment interaction.
• Correlate email gateway telemetry on inbound attachments with endpoint process execution on the recipient host.

Monitoring Recommendations

• Centralize endpoint, email, and identity telemetry in a SIEM to correlate phishing delivery with post-open execution.
• Monitor patch deployment status across Microsoft 365 Apps and Office LTSC 2021/2024 installations to confirm coverage.
• Track Microsoft Defender ASR rule events related to Office child process creation and executable content from email.

How to Mitigate CVE-2025-32705

Immediate Actions Required

• Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2025-32705 across all Outlook installations.
• Enable Microsoft Defender Attack Surface Reduction (ASR) rules blocking Office applications from creating child processes and from injecting code into other processes.
• Validate that Microsoft 365 Apps clients are on a serviced update channel and have current builds.

Patch Information

Microsoft published the fix in the May 13, 2025 security update cycle. Administrators should reference the Microsoft Security Update Guide for CVE-2025-32705 for specific KB articles and build numbers per affected channel (Microsoft 365 Apps Enterprise, Office LTSC 2021, Office LTSC 2024).

Workarounds

• Enable Outlook reading pane restrictions and disable automatic preview of untrusted content where operationally feasible.
• Enforce attachment filtering at the email gateway to strip or sandbox high-risk file types.
• Apply Protected View and Office macro restrictions via Group Policy to limit exposure prior to patch rollout.

# Example PowerShell to verify Microsoft 365 Apps update channel and version
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" |
    Select-Object VersionToReport, UpdateChannel, CDNBaseUrl

# Trigger an on-demand update of Microsoft 365 Apps
& "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update user